my auth.net settings too restrictive?

[blakekr]

I'm a rank newbie to the whole merch acct/payment gateway thing. And not surprisigly, in setting up Auth.net settings, I'm flying blind, and finding that customers are getting a lot of cards rejected. I know avoiding fraud is important, but my customers on the whole are not a high-risk group.

Right now my settings are:

Reject Transaction If Card Code value:
Does NOT Match (N) [CHECKED]
Is NOT Processed (P) [CHECKED]
Should be on card, but is not indicated (S) [CHECKED]
Issuer is not certified or has not provided encryption key (U) [NOT CHECKED]

AVS SETTINGS

Reject If...
Address information is not provided for AVS Check (B) [CHECKED]
AVS Error (E) [CHECKED]
Non US Card Issuing Bank (G) [CHECKED]
Retry, system is unavailable (R) [CHECKED]
AVS is not supported by card issuing bank (S) [CHECKED]
Address information for cardholder is unavailable (U)

Reject If Street Address Matches AND
First 5 digits of Zip Code Match (Y)
First 5 digits of ZIP Code Do NOT Match (A) [CHECKED]

Reject If Street Address Does Not Match AND
9 digits of Zip Code Match (W)
First 5 digits of Zip Code Match (Z)
First 5 digits of ZIP Code Do NOT Match (N) [CHECKED]
------------

I would LOVE some feedback on these settings from more experienced store owners. Like I said, I think they're probably too restrictive based on the number of failed transactions I'm seeing, and I probably have something really dumb in there since I totally fail to understand why something like this would even be an option:

Quote:

Reject If Street Address Matches AND
First 5 digits of Zip Code Match (Y)

Thanks for your thoughts!

[limoshawn]

You will have to find a balance that you are comfortable with. We have removed almost all of the security checks; the only thing required is the cvv. For us, this has worked the best. We have very few rejected transactions and because we require so little information our checkout (conversion) rate is much higher. The trade-off is that our processing rate is higher.

Good luck.

[blakekr]

Thanks! I'll experiment... you gave me a little confidence to play around with it.

[rocknbil]

The address/zip code check is tricky. People move and don't update their info. It doesn't apply for non-US orders. So rejecting on those parameters wil lose some sales for you.

What we do is perform the address/zip code check, but accept the payment, and the results of the address/zip code match are stored and available from our administration. If we get one that doesn't match, we examine it a little more closely - but to date, 100% of them were legitimate purchases.

[blakekr]

Thanks! Appreciate your experience. I think I'll try a similar approach unless I run into major problems.

[HRoth]

I have pretty much all of them unchecked. For one thing, I get about 10% of my business from overseas, and I hope this will increase as globalization increases (and as the dollar falls). For another, I have found that AVS will often kick out a PO box even though it actually is the billing address. Even when the street name is a number it will sometimes reject it. So the AVS thing doesn't mean much. The other thing to consider is that gift cards will never give a match on the billing address, so you automatically reject all purchasers who are using gift cards. And I have been surprised to find out that a number of people purchase gift cards for their own use on the Internet as a kind of security device for themselves. For me, what works best is to consider what the individual is buying. Certain items I sell seem to have more fraudulent charges than any others. Those I focus on, and if there is no match on the billing address, I will check the phone number in the White Pages or ask the customer for more info. It does depend on what you sell, though. The things I sell just generally don't attract much fraud. I would have a different policy if I were selling electronic equipment or computers.